Privacy and data rules

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

301 paragraphs · Pharmaceutical Preparations show all sectors

protection, storage and privacy requirements, including new and greater monetary fines or penalties for privacy violations, and jurisdictions where we operate have passed, or continue to propose, data privacy legislation and or regulations. Failure to comply with these laws could result in significant penalties, including potential exclusion from federal healthcare programs, and reputational harm and could have a material adverse effect on our business and results of operations.

Read in the 10-K filed Feb 12, 2025 ↗

We are subject to data privacy and security laws and regulations in various jurisdictions that apply to the collection, storage, use, sharing, and security of personal data, including health information, and impose significant compliance obligations. In addition, numerous other federal and state laws, including state security breach notification laws, state health information privacy laws and federal and state consumer protection laws, govern the collection, use, disclosure and security

Read in the 10-K filed Feb 13, 2025 ↗

of personal information. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. As we enter into new disease areas and jurisdictions both commercially and for clinical trials, we must continue to evaluate new and evolving privacy laws.

Read in the 10-K filed Feb 13, 2025 ↗

For example, the E.U. General Data Protection Regulation (“GDPR”) went into effect in 2018 and has imposed new obligations on us with respect to our processing of personal data and the cross-border transfer of such data, including higher standards of obtaining consent, more robust transparency requirements, data breach notification requirements, requirements for contractual language with our data processors, and stronger individual data rights. Different E.U. member states have interpreted the GDPR differently and many have imposed additional requirements, which add to the complexity of processing personal data in the E.U. The GDPR also imposes strict rules on the transfer of personal data to countries outside the E.U., including the U.S. and the U.K., and permits data protection authorities to impose large penalties for violations of the GDPR. Similarly, other jurisdictions have either introduced or enacted legislation or executive orders restricting cross-border data transfers. These regulations restrict the transfer of certain types of data (e.g., sensitive personal data) or restrict the transfer of data to certain jurisdictions. The rules related to cross border data transfers continue to evolve based on court decisions and regulator guidance, which presents certain practical challenges to compliance. Regulators also continue to focus enforcement efforts on behavioral advertising and other online tracking technologies commonly used by companies. Compliance with these evolving rules is challenging, as country specific guidance and rules are continually changing and limited alternatives currently exist in the market. Compliance with the these laws and regulations is a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with any activities falling within the scope of the GDPR or other privacy laws or regulations.

Read in the 10-K filed Feb 13, 2025 ↗

In the U.S., numerous states have introduced or enacted comprehensive privacy legislation. Similar to the California Consumer Rights Act, which came into effect in January 2023), these comprehensive privacy laws place numerous obligations on businesses with respect to the collection and processing of personal data. Some states have passed privacy legislation focusing specifically on the collection and processing of consumer health data. Enforcement at the federal level in the U.S. from the FTC has been focused on the use of health information for targeted advertising. While we continue to address the implications of the new data privacy regulations, data privacy remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges. Each law is also subject to various interpretations by courts and regulatory agencies, creating even more uncertainty. While we have a global privacy program that addresses such laws and regulations, our efforts to comply with the evolving data protection rules may be unsuccessful.

Read in the 10-K filed Feb 13, 2025 ↗

We must devote significant resources to understanding and complying with the changing landscape in this area. Failure to comply with data protection laws may expose us to risk of enforcement actions taken by data protection authorities, private rights of action in some jurisdictions, and potential significant penalties if we are found to be non-compliant. Failure to comply with the GDPR and applicable national data protection laws of European Economic Area member states could lead to fines of up to €20,000,000 or up to 4% of the total worldwide annual revenue of the preceding financial year, whichever is higher. Some of these laws and regulations also carry the possibility of criminal sanctions. For example, while we are not directly subject to the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HIPAA”), we could be subject to penalties, including criminal penalties if we knowingly obtain or disclose individually identifiable health information from a HIPAA-covered health care provider or research institution that has not complied with HIPAA’s requirements for disclosing such information. In addition, the commercialization of cell and gene therapies requires the collection and processing of a greater amount of personal data than traditional therapies, potentially increasing risk. Furthermore, the number of government investigations and enforcement actions related to data security incidents and privacy violations, with a specific focus on online data sharing, continue to increase and government investigations typically require significant resources and generate negative publicity, which could harm our business and our reputation.

Read in the 10-K filed Feb 13, 2025 ↗

We have expanded our international operations over the past several years to market our medicines and expand our research and development capabilities. New laws and industry codes in the E.U. and elsewhere have expanded transparency requirements regarding payments and transfers of value to healthcare professionals, requirements surrounding patient-level clinical trial data, the protection of personal data and increased sanctions for violations. Collectively, our expansion and these new requirements are adding to our compliance costs and potentially exposes us to sanctions in the event of an infringement or failure to report in these jurisdictions. In addition, a significant portion of our commercial supply chain, including sourcing of raw materials and manufacturing, is located in China and the E.U. Consequently, we are, and will continue to be, subject to risks related to operating in foreign countries, including risks relating to intellectual property protections and business interruptions. Risks associated with operating a global biotechnology company include:

Read in the 10-K filed Feb 13, 2025 ↗

We are or may be involved in various legal proceedings, including securities/shareholder matters and claims related to product liability, intellectual property, employment law, competition law, data privacy, and breach of contract. Such proceedings may involve claims for, or the possibility of, damages or fines and penalties involving substantial amounts of money or other relief, including civil or criminal fines and penalties. If any of these legal proceedings were to result in an adverse outcome, it could have a material adverse effect on our business.

Read in the 10-K filed Feb 13, 2025 ↗

We maintain and rely extensively on information technology systems and network infrastructures for the effective operation of our business. In the course of our business, we collect, store, and transmit confidential information (including personal information and intellectual property), and it is critical that we do so in a secure manner to maintain the confidentiality, integrity, and availability of such confidential information. A disruption, infiltration, or failure of our information technology systems or any of our data centers as a result of software or hardware malfunctions, computer viruses, cyber-attacks, employee theft or misuse, power disruptions, natural disasters, floods or accidents could cause breaches of data security and loss of critical data, which in turn could materially adversely affect our business and subject us to both private and governmental causes of action. While we have implemented security measures to minimize these risks to our data and information technology systems and have adopted a business continuity plan to deal with a disruption to our information technology systems, there can be no assurance that our efforts to protect our data and information systems will prevent breakdowns or breaches in our systems that could adversely affect our business. In addition, we maintain cyber liability insurance, however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems and those of critical third parties.

Read in the 10-K filed Feb 13, 2025 ↗

Cyber-attacks are increasing in their frequency, sophistication, and intensity, and are becoming increasingly difficult to detect. They are often carried out by well-resourced and skilled parties, including nation states, organized crime groups, “hacktivists” and employees or contractors acting carelessly or with malicious intent. Cyber-attacks include deployment of harmful malware and key loggers, ransomware, denial-of-service attacks, malicious websites, the use of social engineering, and other means to affect the confidentiality, integrity and availability of our technology systems and data. Cyber-attacks also include manufacturing, hardware or software supply chain attacks, which could cause a delay in the manufacturing of products or products produced for contract manufacturing or lead to a data privacy or security breach. Our business partners face similar risks and when they experience a security breach of their systems, our security can be adversely affected. Similar to other companies, we have experienced immaterial cybersecurity incidents, including temporary service interruptions of third-party suppliers. In addition, our increased use of cloud technologies heightens these third party and other operational risks, and any failure by cloud or other technology service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption, or loss of confidential or propriety information. A significant portion of our workforce continues to leverage hybrid work. Risk of cyber-attack is increased with employees working remotely. Remote work increases the risk we may be vulnerable to cybersecurity-related events such as phishing attacks and other security threats.

Read in the 10-K filed Feb 13, 2025 ↗

Social media is being used by third parties to communicate about our products and product candidates and the diseases our therapies are designed to treat. We believe that members of the communities supporting serious diseases may be more active on social media as compared to other patient populations due to the demographics of those patient populations. Social media practices in the pharmaceutical and biotechnology industries are evolving, which creates uncertainty and risk of noncompliance with regulations applicable to our business. For example, patients may use social media platforms to comment on the effectiveness of, or adverse experiences with, a product or a product candidate, which could result in reporting obligations. In addition, our employees may engage on social media in ways that may not comply with legal or regulatory requirements, which may give rise to liability, lead to the loss of trade secrets and other intellectual property, or result in public disclosure of protected personal information. There is a risk of inappropriate disclosure of sensitive information or negative or inaccurate posts or comments about us on any social networking website. Negative sentiment about us or our business shared over social media, or misinformation disseminated from fraudulent accounts impersonating our employees or our business, or otherwise, could harm our business and reputation, whether or not it is based in fact. Certain data protection regulations, such as the GDPR, apply to personal data contained on social media. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions or incur harm to our business, including damage to our reputation. Similar risks relating to inappropriate disclosure of sensitive information or inaccurate information appearing in the public domain may also apply from our employees engaging with and use of new artificial intelligence tools, such as ChatGPT.

Read in the 10-K filed Feb 13, 2025 ↗